Finding salt, with known pass and part of hash

[Flipper]

Hi!

I've been struggling for a while to find something that could help with this problem. It seems hashcat was the closest to help me, but I'm not sure, even reading the documentation, don't know if I'll be able to do this.

Let me explain, I got this situation (just an example):

md5($pass + $salt) = ??????xxxxxxx??????? (x = known)

I want to find the salt, knowing the password and part of the hash. Let's say that, out of 16 bytes in MD5, I have 10 known bytes. Don't know where these bytes exactly are inside the hash, but they are (probably) contiguous. Also, not sure if the order is $pass+$salt or $salt+pass.

Anyway, I need to brute-force the salt, until one of the generated hashes *contains* some specific 10 bytes sequence (this means 7 possible positions inside a MD5 hash). It could tell me which one matched, and continue checking for more possible matches. I'll be able to validate the salt by comparing with other samples.

Is it feasible at all? If yes, is that possible with hashcat? In case of a "no", I probably will never find one that does!

Hope I could explain it properly.

Thanks!